An XCCDF Rule
pam_faillock.so
/etc/pam.d/password-auth
/etc/pam.d/system-auth
deny=<count>
authselect
authconfig